EXTRA

Question 1

DomainKeys Identified Mail (DKIM) is an email authentication method designed to detect forged sender addresses in email (email spoofing), a technique often used in phishing and email spam.

DKIM allows the receiver to check that an email claimed to have come from a specific domain was indeed authorized by the owner of that domain.[1] It achieves this by affixing a digital signature, linked to a domain name, to each outgoing email message. The recipient system can verify this by looking up the sender’s public key published in the DNS.

Answer 1

DKIM Info

Question 2

is an email authentication protocol. It is designed to give email domain owners the ability to protect their domain from unauthorized use.

Once the DMARC DNS entry is published, any receiving email server can authenticate the incoming email based on the instructions published by the domain owner within the DNS entry. If the email passes the authentication, it will be delivered and can be trusted. If the email fails the check, depending on the instructions held within the DMARC record the email could be delivered, quarantined or rejected.

Answer 2

DMARC

Question 3

allows the receiving mail server to check during mail delivery that a mail claiming to come from a specific domain is submitted by an IP address authorized by that domain’s administrators.[3] The list of authorized sending hosts and IP addresses for a domain is published in the DNS records for that domain.

is an email authentication method designed to detect forging sender addresses during the delivery of the email.[1] SPF alone, though, is limited to detecting a forged sender claim in the envelope of the email, which is used when the mail gets bounced.[1] Only in combination with DMARC can it be used to detect the forging of the visible sender in emails (email spoofing[2]), a technique often used in phishing and email spam.

Answer 3

SPF

Question 4

??? identify potentially malicious actors based on their use of IP address, email address, domains, etc that were previously used in attacks.

??? identify potentially malicious actors based upon similarity of their behaviors to past attackers.

Answer 4

Reputational Threat Research / Behavioral Threat Research